CVE Vulnerability Catalog

The mchange-commons-java library prior to version 0.6.0 has a vulnerability in its JNDI ObjectFactory implementation (JavaBeanObjectFactory) that allows constructing objects of arbitrary classes and initializing their JavaBean-style properties. For certain classes like Swing JEditorPane, this enables HTTP requests to arbitrary URLs, which can be exploited for JNDI injection and deserialization attacks.

A Remote Code Execution vulnerability exists in @tinacms/cli prior to version 2.4.3 during the Forestry-to-Tina migration. The addVariablesToCode helper unsafely processes user-supplied label and name fields from .forestry/**/*.yml, allowing arbitrary JavaScript injection into the generated tina/templates.{ts,js} file.

A Use-After-Free vulnerability in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code remotely over a network.

A vulnerability in NodeBB allows a remote attacker to impersonate any local user, including the administrator, by forging posts and private messages via the ActivityPub protocol. The issue stems from missing validation that the authenticated remote actor is the actual author of the ActivityPub object.

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to create_host_function, whose host callback captures and later reads that reference; once the ESM link-loop iteration ends the FunctionType is destroyed, leaving the callback with a dangling reference. Stale result-type data lets the host callback return an empty result vector for a statically non-empty result, so the destination register retains an attacker-influenced value that is then consumed by the WASM-GC array.set handler, which bit-casts the reference low bits to an ArrayInstance pointer after only a null check, yielding an arbitrary write.

A deserialization vulnerability in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 allows arbitrary code execution via untrusted data from Redis or Valkey cache. An attacker with write access to the shared cache infrastructure can inject a crafted Java object that, when read by the application server, triggers code execution.

A path traversal vulnerability in the FileExplorer component of Gradio before version 6.16.0 allows unauthenticated attackers to read files outside the configured root directory. Attackers can use traversal sequences or absolute paths that cause os.path.join to discard the root_dir prefix.

Dell Device Management Agent (DDMA) versions prior to 26.05 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

OS command injection vulnerability in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib. An attacker controlling dependency version strings in package.json can execute arbitrary commands on the CDK toolchain host via injected shell metacharacters.

An insertion of sensitive information into sent data vulnerability in HubSpot allows retrieval of embedded sensitive data. This issue affects HubSpot from n/a through 11.3.51.

A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.

A vulnerability in the HTTP/2 HPACK decoder in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement applies the configured header list size limit.

CWE-117 vulnerability in Kibana allows injection of unsanitized data into logs. An attacker can supply specially crafted input that is written to log files without proper neutralization. When logs are viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

In containerd prior to versions 1.7.32, 2.0.9, 2.2.4, and 2.3.1, containers with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. This allows bypassing the Kubernetes runAsNonRoot restriction if a crafted image maps this large numeric string to root in /etc/passwd, causing the container to run as root (UID 0).

JAIOTlink C492A-W6 Wi-Fi IP cameras with firmware 4.8.30.57701411 contain a remote code execution vulnerability. An authenticated attacker can write a malicious script to persistent JFFS2 storage and trigger execution via an HTTP endpoint, achieving persistent control over the device.

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability. An authenticated attacker can achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint.

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader. An attacker can achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function, which unconditionally calls pickle.loads() on .pkl/.pickle entries and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code on every remote worker processing the archive.

An uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessive header length.

SQL Injection vulnerability in Guardian language-system allows an authenticated attacker to inject SQL code via the id parameter in translate_text.php. Lack of input sanitization enables extraction of database contents.

An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'name' GET parameter in designer.php. Unsanitized input enables arbitrary SQL execution and extraction of database contents.